Privacy policy

Privacy Policy of www.broken-luxury.com

Www.broken-luxury.com collects some Personal Data from its Users.

Owner and Data Controller PLAN OF ACTION S.R.L.

Aleea Alexandru 34, Ap. 9

011824 Bucharest

Romania

Email: info@broken-luxury.com

Managing Director: Marco Peter Seitz, Bucharest

VAT-Nr.: RO43805497

Company-Registration-Nr.: J40/3444/2021

Owner contact email: info@broken-luxury.com

Types of Data collected

Among the types of Personal Data that www.broken-luxury.com collects, by itself or through third parties, there are: Trackers; Usage Data; first name; last name; gender; date of birth; phone number; VAT Number; company name; profession; physical address; fax number; country; state; county; email address; ZIP/Postal code; various types of Data; city; Tax ID; field of activity; User ID; number of employees; website; billing address; shipping address; payment info; device information; username; password; purchase history; Data communicated while using the service; financial information; in-app purchases; invoicing information; user subscriptions; unique device identifiers for advertising (Google Advertiser ID or IDFA, for example); Email; contact info; language; time zone; product interaction; geographic position; profile picture; picture; answers to questions; workplace; marital status; Social Security number (SSN); house number; prefix ; data relating to the point of sale; Twitter handle; budget; geography/region; academic background; screenshots; mouse movements; motion sensor events; Data communicated in order to use the Service; scroll position; keypress events; touch events; clicks; device logs; app information.

Complete details on each type of Personal Data collected are provided in the dedicated sections of this privacy policy or by specific explanation texts displayed prior to the Data collection.

Personal Data may be freely provided by the User, or, in case of Usage Data, collected automatically when using www.broken-luxury.com.

Unless specified otherwise, all Data requested by www.broken-luxury.com is mandatory and failure to provide this Data may make it impossible for www.broken-luxury.com to provide its services. In cases where www.broken-luxury.com specifically states that some Data is not mandatory, Users are free not to communicate this Data without consequences to the availability or the functioning of the Service.

Users who are uncertain about which Personal Data is mandatory are welcome to contact the Owner.

Any use of Cookies – or of other tracking tools – by www.broken-luxury.com or by the owners of third-party services used by www.broken-luxury.com serves the purpose of providing the Service required by the User, in addition to any other purposes described in the present document and in the Cookie Policy, if available.

Users are responsible for any third-party Personal Data obtained, published or shared through www.broken- luxury.com and confirm that they have the third party's consent to provide the Data to the Owner.

Mode and place of processing the Data

Methods of processing

The Owner takes appropriate security measures to prevent unauthorized access, disclosure, modification, or

unauthorized destruction of the Data.

The Data processing is carried out using computers and/or IT enabled tools, following organizational procedures and modes strictly related to the purposes indicated. In addition to the Owner, in some cases, the Data may be accessible to certain types of persons in charge, involved with the operation of www.broken- luxury.com (administration, sales, marketing, legal, system administration) or external parties (such as third- party technical service providers, mail carriers, hosting providers, IT companies, communications agencies) appointed, if necessary, as Data Processors by the Owner. The updated list of these parties may be requested from the Owner at any time.

Legal basis of processing

The Owner may process Personal Data relating to Users if one of the following applies:

Users have given their consent for one or more specific purposes. Note: Under some legislations the Owner may be allowed to process Personal Data until the User objects to such processing (“opt-out”), without having to rely on consent or any other of the following legal bases. This, however, does not apply, whenever the processing of Personal Data is subject to European data protection law; provision of Data is necessary for the performance of an agreement with the User and/or for any pre- contractual obligations thereof;

processing is necessary for compliance with a legal obligation to which the Owner is subject; processing is related to a task that is carried out in the public interest or in the exercise of official authority vested in the Owner;

processing is necessary for the purposes of the legitimate interests pursued by the Owner or by a third party.

In any case, the Owner will gladly help to clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.

Place

The Data is processed at the Owner's operating offices and in any other places where the parties involved in the processing are located.

Depending on the User's location, data transfers may involve transferring the User's Data to a country other than their own. To find out more about the place of processing of such transferred Data, Users can check the section containing details about the processing of Personal Data.

Users are also entitled to learn about the legal basis of Data transfers to a country outside the European Union or to any international organization governed by public international law or set up by two or more countries, such as the UN, and about the security measures taken by the Owner to safeguard their Data.

If any such transfer takes place, Users can find out more by checking the relevant sections of this document or inquire with the Owner using the information provided in the contact section.

Retention time

Personal Data shall be processed and stored for as long as required by the purpose they have been collected for.

Therefore:

Personal Data collected for purposes related to the performance of a contract between the Owner and the User shall be retained until such contract has been fully performed.

Personal Data collected for the purposes of the Owner’s legitimate interests shall be retained as long as needed to fulfill such purposes. Users may find specific information regarding the legitimate interests pursued by the Owner within the relevant sections of this document or by contacting the Owner.

The Owner may be allowed to retain Personal Data for a longer period whenever the User has given consent to such processing, as long as such consent is not withdrawn. Furthermore, the Owner may be obliged to retain Personal Data for a longer period whenever required to do so for the performance of a legal obligation or upon order of an authority.

Once the retention period expires, Personal Data shall be deleted. Therefore, the right of access, the right to erasure, the right to rectification and the right to data portability cannot be enforced after expiration of the retention period.

The purposes of processing

The Data concerning the User is collected to allow the Owner to provide its Service, comply with its legal obligations, respond to enforcement requests, protect its rights and interests (or those of its Users or third parties), detect any malicious or fraudulent activity, as well as the following: Analytics, Displaying content from external platforms, Tag Management, Contacting the User, Interaction with external social networks and platforms, Access to third-party accounts, Platform services and hosting, Registration and authentication, Handling payments, Selling goods and services online, Managing contacts and sending messages, User database management, Managing data collection and online surveys, Remarketing and behavioral targeting, Advertising, Building and running www.broken-luxury.com, Data transfer outside the EU, Data transfer outside of the UK, Collection of privacy-related preferences, Backup saving and management, Interaction with data collection platforms and other third parties, Commercial affiliation, Hosting and backend infrastructure, Interaction with support and feedback platforms, Registration and authentication provided directly by www.broken-luxury.com, Handling activities related to productivity, SPAM protection, Connecting Data and Infrastructure monitoring.

For specific information about the Personal Data used for each purpose, the User may refer to the section “Detailed information on the processing of Personal Data”.

Facebook permissions asked by www.broken-luxury.com

Www.broken-luxury.com may ask for some Facebook permissions allowing it to perform actions with the User's Facebook account and to retrieve information, including Personal Data, from it. This service allows www.broken-luxury.com to connect with the User's account on the Facebook social network, provided by Facebook Inc.

For more information about the following permissions, refer to the Facebook permissions documentation and to the Facebook privacy policy.

The permissions asked are the following:

Basic information

By default, this includes certain User’s Data such as id, name, picture, gender, and their locale. Certain connections of the User, such as the Friends, are also available. If the User has made more of their Data public, more information will be available.

About Me

Provides access to the 'About Me' section of the profile.

Access Friend Lists

Provides access to any friend lists the User created.

Access Page CTA

Provides the access to manage call to actions on User-managed Pages.

Access private data

Access the User's and friends' private data.

Access Requests

Provides read access to the User's friend requests.

Activities

Provides access to the User's list of activities.

Age range

Provides access to the User's age range.

App Notifications

Send notifications.

Birthday

Provides access to the birthday.

Books Actions

Shows when the User has rated, read, quoted from or has said they want to read a book with the app.

Business Management API

Read and write with Business Management API.

Chat

Provides applications that integrate with Facebook Chat the ability to log in Users.

Checkins

Provides read access to the authorized User's check-ins.

Contact email

Access the User's contact email address.

Create Events

Enables the application to create and modify events on the User's behalf.

Create notes

Add or modify notes.

Current City

Provides access to the User's current location.

Custom Friend Lists Access

Provides access to the names of custom lists the User has created to organize their friends.

Custom User Actions

Allows the app retrieve the actions published by another application as specified by the app namespace.

Deals

Read the deal activity.

device information

Education History

Provides access to education history.

Provides access to the User's primary email address.

Events

Provides access to the list of events the User is attending.

Export Posts

Export the posts and make them public. All posts will be exported, including status updates.

Family Members and Relationship Status

Provides access to the User's family and personal relationships and relationship status.

Fitness Actions

Shows the User's workout with the app.

Friend subscriptions

Provides access to the User's friends subscriptions associated with the app.

Friends' About Me

Provides access to the 'About Me' section of the friends' profile.

Friends' Activities

Provides access to the friends' list of activities.

Friends' birthdays

Provides access to the friends' birthdays.

Friends' Checkins

Provides read access to the friends' check-ins that the User can see.

Friends' Current Cities

Provides access to the friends' current locations.

Friends' Custom User Actions

Allows the app to retrieve the actions published by another application as specified by the app namespace.

Friends' Education History

Provides access to friends' education history.

Friends' Events

Provides access to the list of events the friends are attending.

Friends' Family Members and Relationship Status

Provides access to a friend's family and personal relationships and relationship status.

Friends' Games and App Activity

Allows the app post and retrieve game achievement activity.

Friends' Groups

Provides access to the list of groups the User's friends are a members of.

Friends' Hometown

Provides access to the friends' hometown.

Friends' Interests

Provides access to the friends' lists of interests.

Friends' Likes

Provides access to the list of all of the pages the friends have liked.

Friends' music.listens Actions

Allows the app to retrieve the actions published by all applications using the built-in music.listens action.

Friends' news.read Actions

Allows the app to retrieve the actions published by all applications using the built-in news.reads action.

Friends' Notes

Provides access to the friends' notes.

Friends' Online Presence

Provides access to the User's friend's online/offline presence.

Friends' Photos

Provides access to the photos the friends have uploaded, and photos the friends have been tagged in.

Friends' Questions

Provides access to the questions the friends have asked.

Friends' Religious and Political Views

Provides access to the friends' religious and political affiliations.

Friends' Significant Others and Relationship Details

Provides access to the friends' relationship preferences.

Friends' Statuses

Provides access to the friends' status messages and checkins.

Friends' video.watches Actions

Allows the app to retrieve the actions published by all applications using the built-in video.watches action.

Friends' Videos

Provides access to the videos the friends have uploaded and have been tagged in.

Friends' Websites

Provides access to the friends' web site URLs.

Friends' Work History

Provides access to a friend's work history.

Games and App Activity

Allows the app post and retrieve game achievement activity.

Gender

Provides access to the User's gender.

Groups

Provides access to the list of groups the User is a member of.

Groups member info

Provides access to publicly available group member information.

Hometown

Provides access to the User's hometown.

Insights

Provides read access to the Insights data for pages, applications, and domains the user owns.

Instagram basic

Allows reading an Instagram account profile information and media.

Instagram manage comments

Allows the creation, deletion and hiding of comments on behalf of the Instagram account linked to a Page. Also allows reading and responding to public media and comments that a business has been photo tagged in or @mentioned in.

Instagram manage insights

Provides access to insights for the Instagram account linked to a Facebook Page. Also gives the possibility to discover and read the profile information and media of other business profiles.

Interests

Provides access to the User's list of interests.

Leads Retrieval

Allows retrieving and reading all information captured by a lead advertisement form with an advertisement created in Ads Manager or the Marketing API.

Likes

Provides access to the list of all of the pages the User has liked.

Link

Provides access to the Facebook Profile URL of the User.

List of Friends

Provides access to the User's list of friends that also use said app.

Manage Advertisements

Provides the ability to manage ads and call the Facebook Ads API on behalf of a User.

Manage Catalog

Allows creating, reading, updating and deleting business-owned product catalogs for which the User is an administrator.

Manage Friend Lists

Enables the app to create, delete and edit the User's friend lists.

Manage Groups

Manage the User's groups.

Manage Mailbox

Read and send messages from the User's mailbox.

Manage Notifications

Enables the app to read notifications and mark them as read.

Manage Pages

Enables the application to retrieve access_tokens for Pages and Applications that the User administrates.

Managing Page Advertisements

Allows managing advertisements associated with the Page.

Mobile Messaging on behalf of Page

Send and receive mobile messages on behalf of a Facebook Page.

music.listen Action

Allows the app to retrieve the actions published by all applications using the built-in music.listens action.

News Feed and Wall

Provides access to all the posts in the User's News Feed and enables the application to perform searches against the User's News Feed.

news.read Actions

Allows the app to retrieve the actions published by all applications using the built-in news.reads action.

Notes

Provides access to the User's notes.

Offline Access

Access the data when the User is not using the application.

Online Presence

Provides access to the User's online/offline presence.

Page Messaging

Send and receive messages through a Facebook Page.

Pages manage CTA

Allows carrying out POST and DELETE functions on endpoints used to manage call-to-action buttons on a Facebook Page.

Pages manage engagement

Allows creating, editing and deleting comments posted on the page.

Pages manage instant articles

Allows managing Instant Articles on behalf of Facebook Pages administered by the User.

Pages manage metadata

Allows subscribing and receiving webhooks about activity on the Page, and updating settings on the Page.

Pages manage posts

Allows the creation, editing and deletion of the User’s Page posts.

Pages read engagement

Provides access to content (posts, photos, videos, events) posted by the Page, access to followers data

(including name, PSID), and profile picture, and access to metadata and other insights about the Page.

Pages read User content

Allows reading User generated content on the Page, such as posts, comments, and ratings by Users or other Pages, and deleting User comments on Page posts.

Pages User locale

Provides access to the User’s locale through the connected Page.

Pages User timezone

Grants access to a User’s time zone through the connected Page.

Photos

Provides access to the photos the User has uploaded, and photos the User has been tagged in.

Post Likes to my Wall

Publish stories about things the User Likes to the Wall.

Publish App Activity

Allows the app to publish to the Open Graph using Built-in Actions, Achievements, Scores, or Custom Actions. The app can also publish other activity which is detailed in the Facebook's Publishing Permissions document.

Publish as Page

Enables the ability to post, comment and like as any of the Pages managed by the User.

Publish Checkins

Enables the app to perform checkins on behalf of the User.

Publish content into groups

Allows posting content into a group on behalf of the User.

Publish to the Wall

Enables the app to post content, comments, and likes to a User's stream and to the streams of the User's friends.

Publish videos

Allows publishing live videos on the User's timeline.

Questions

Provides access to the questions the User has asked.

Read advertisements

Allows to pull advertisement report information for advertisements accounts owned or granted access to by the owner or owners of other advertisement accounts, through this permission. Also provides access to the Server-Side API to allow advertisers to send web events from their servers directly to Facebook.

Read attribution

Grants access to the Attribution API to pull attribution report data for lines of business owned or granted access to by the owner or owners of other lines of business.

Read Group Content

Lets the app read content in a group managed by the User.

Read insights

Allows reading the Insights data for Pages, apps and web domains the User owns.

Read Mailbox

Provides the ability to read from a user's Facebook Inbox.

Read page mailbox

Lets the app read from the page inboxes of the pages managed by the User.

Religious and Political Views

Provides access to the User's religious and political affiliations.

RSVP to Events

Enables the application to RSVP to events on the User's behalf.

Share items on the User's behalf.

Show List of Managed Pages

Provides the access to show the list of the Pages that the User manages.

Significant Other and Relationship Details

Provides access to the User's relationship preferences.

Status

Provides access to the User's status messages and checkins.

Status Updates

Update the User's status.

Tagged Places

Provides access to the places the User has been tagged at in photos, videos, statuses and links.

Text Messaging

Send SMS messages to the User's phone.

Trackers

Tracker indicates any technology - e.g Cookies, unique identifiers, web beacons, embedded scripts, e-tags and fingerprinting - that enables the tracking of Users, for example by accessing or storing information on the User’s device.

Upload Photos

Add or modify user's photos.

Usage Data

User location

Allows reading the city name as listed in the location field of a User’s Facebook profile. User subscriptions

Provides access to the User's subscriptions associated with the app.

User Timeline Posts Access

Provides access to the posts on a Users's timeline.

User videos

Allows reading a list of videos uploaded by a User.

Video upload

Add or modify User's videos.

video.watches Action

Allows the app to retrieve the actions published by all applications using the built-in video.watches action.

Videos

Provides access to the videos the User has uploaded and videos the User has been tagged in.

Website

Provides access to the User's web site URL.

Whatsapp business management

Allows reading and/or managing WhatsApp business assets owned or granted access to by other businesses through this permission. These business assets include WhatsApp business accounts, phone numbers and message templates.

Work History

Provides access to work history.

Detailed information on the processing of Personal Data

Personal Data is collected for the following purposes and using the following services:

Access to third-party accounts

This type of service allows www.broken-luxury.com to access Data from your account on a third-party service and perform actions with it.

These services are not activated automatically, but require explicit authorization by the User.

Facebook account access

This service allows www.broken-luxury.com to connect with the User's account on the Facebook social network, provided by Meta Platforms, Inc. or by Meta Platforms Ireland Limited, depending on how the Owner manages the Data processing.

Permissions asked: About Me; Access Friend Lists; Access Page CTA; Access private data; Access Requests; Activities; Age range; App Notifications; Birthday; Books Actions; Business Management API; Chat; Checkins; Contact email; Create Events; Create notes; Current City; Custom Friend Lists Access; Custom User Actions; Deals; device information; Education History; Email; Events; Export Posts; Family Members and Relationship Status; Fitness Actions; Friend subscriptions; Friends' About Me; Friends' Activities; Friends' birthdays; Friends' Checkins; Friends' Current Cities; Friends' Custom User Actions; Friends' Education History; Friends' Events; Friends' Family Members and Relationship Status; Friends' Games and App Activity; Friends' Groups; Friends' Hometown; Friends' Interests; Friends' Likes; Friends' music.listens Actions; Friends' news.read Actions; Friends' Notes; Friends' Online Presence; Friends' Photos; Friends' Questions; Friends' Religious and Political Views; Friends' Significant Others and Relationship Details; Friends' Statuses; Friends' video.watches Actions; Friends' Videos; Friends' Websites; Friends' Work History; Games and App Activity; Gender; Groups; Groups member info; Hometown; Insights; Instagram basic; Instagram manage comments; Instagram manage insights; Interests; Leads Retrieval; Likes; Link; List of Friends; Manage Advertisements; Manage Catalog; Manage Friend Lists; Manage Groups; Manage Mailbox; Manage Notifications; Manage Pages; Managing Page Advertisements; Mobile Messaging on behalf of Page; music.listen Action; News Feed

and Wall; news.read Actions; Notes; Offline Access; Online Presence; Page Messaging; Pages manage CTA; Pages manage engagement; Pages manage instant articles; Pages manage metadata; Pages manage posts; Pages read engagement; Pages read User content; Pages User locale; Pages User timezone; Photos; Post Likes to my Wall; Publish App Activity; Publish as Page; Publish Checkins; Publish content into groups; Publish to the Wall; Publish videos; Questions; Read advertisements; Read attribution; Read Group Content; Read insights; Read Mailbox; Read page mailbox; Religious and Political Views; RSVP to Events; Share; Show List of Managed Pages; Significant Other and Relationship Details; Status; Status Updates; Tagged Places; Text Messaging; Trackers; Upload Photos; Usage Data; User location; User subscriptions; User Timeline Posts Access; User videos; Video upload; video.watches Action; Videos; Website; Whatsapp business management; Work History.

Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

Pinterest account access (Pinterest, Inc.)

This service allows www.broken-luxury.com to connect with the User's account on Pinterest, provided by Pinterest, Inc.

Personal Data processed: device information; Email; Trackers; unique device identifiers for advertising (Google Advertiser ID or IDFA, for example); Usage Data; User ID.

Place of processing: United States – Privacy Policy.

Stripe account access

This service allows www.broken-luxury.com to connect with the User's account on Stripe, provided by Stripe, Inc.

Personal Data processed: Data communicated while using the service; device information; email address; first name; last name; password; payment info; Trackers; Usage Data; username.

Place of processing: United States – Privacy Policy; United Kingdom – Privacy Policy; Brazil – Privacy Policy; European Union ; Gibraltar – Privacy Policy; Hong Kong – Privacy Policy; Liechtenstein – Privacy Policy; Norway – Privacy Policy; Switzerland – Privacy Policy; United Arab Emirates – Privacy Policy; United Kingdom – Privacy Policy; Canada – Privacy Policy; India – Privacy Policy; Japan – Privacy Policy; Malaysia – Privacy Policy; Mexico – Privacy Policy; New Zealand – Privacy Policy; Singapore – Privacy Policy; Thailand – Privacy Policy.

Advertising

This type of service allows User Data to be utilized for advertising communication purposes. These communications are displayed in the form of banners and other advertisements on www.broken-luxury.com, possibly based on User interests.

This does not mean that all Personal Data are used for this purpose. Information and conditions of use are shown below.

Some of the services listed below may use Trackers to identify Users or they may use the behavioral retargeting technique, i.e. displaying ads tailored to the User’s interests and behavior, including those detected outside www.broken-luxury.com. For more information, please check the privacy policies of the relevant services.

Services of this kind usually offer the possibility to opt out of such tracking. In addition to any opt-out feature offered by any of the services below, Users may learn more on how to generally opt out of interest-based advertising within the dedicated section "How to opt-out of interest-based advertising" in this document.

Pinterest Ads (Pinterest, Inc.)

Pinterest Ads is an advertising service provided by Pinterest, Inc. that allows the Owner to run advertising campaigns on the Pinterest advertising network.

Users may opt out of behavioral advertising features through their device settings, their Pinterest personalization settings.

Personal Data processed: device information; email address; Trackers; unique device identifiers for advertising (Google Advertiser ID or IDFA, for example); Usage Data; User ID.

Place of processing: United States – Privacy Policy – Opt out.

Amazon Advertising

Amazon Advertising is an advertising service provided by Amazon Europe or by Amazon, depending on how

the Owner manages the Data processing.

Personal Data processed: Trackers; Usage Data.

Place of processing: European Union – Privacy Policy – Opt out; United States – Privacy Policy – Opt out.

Adlane (Adlane LTD)

Adlane is an advertising service provided by Adlane LTD. Personal Data processed: Trackers; Usage Data.

Place of processing: Bulgaria – Privacy Policy.

Analytics

The services contained in this section enable the Owner to monitor and analyze web traffic and can be used to keep track of User behavior.

Google Analytics

Google Analytics is a web analysis service provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Data processing, (“Google”). Google utilizes the Data collected to track and examine the use of www.broken-luxury.com, to prepare reports on its activities and share them with other Google services.

Google may use the Data collected to contextualize and personalize the ads of its own advertising network. Personal Data processed: Trackers; Usage Data.

Place of processing: United States – Privacy Policy – Opt Out; Ireland – Privacy Policy – Opt Out.

Google Analytics with anonymized IP

Google may use the Data collected to contextualize and personalize the ads of its own advertising network. This integration of Google Analytics anonymizes your IP address. It works by shortening Users' IP addresses within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the complete IP address be sent to a Google server and shortened within the US.

Personal Data processed: Trackers; Usage Data.

Place of processing: United States – Privacy Policy – Opt Out; Ireland – Privacy Policy – Opt Out.

Pinterest Conversion Tag (Pinterest, Inc.)

Pinterest Conversion Tag is an analytics service provided by Pinterest, Inc. that connects data from the Pinterest advertising network with actions performed on www.broken-luxury.com.

Users may opt out of behavioral advertising features through their device settings, their Pinterest personalization settings or by visiting the AdChoices opt-out page.

Personal Data processed: device information; Trackers; Usage Data. Place of processing: United States – Privacy Policy – Opt out.

Backup saving and management

This type of service allows the Owner to save and manage backups of www.broken-luxury.com on external servers managed by the service provider itself. The backups may include the source code and content as well as the data that the User provides to www.broken-luxury.com.

Backup on Dropbox (Dropbox, Inc.)

Dropbox is a service to save and manage backups provided by Dropbox Inc.

Personal Data processed: various types of Data as specified in the privacy policy of the service.

Place of processing: United States – Privacy Policy; European Union – Privacy Policy; Austria – Privacy Policy;

Germany – Privacy Policy; United Kingdom – Privacy Policy; Japan – Privacy Policy.

Backup on Google Drive

Google Drive is a service to save and manage backups provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Data processing.

Personal Data processed: various types of Data as specified in the privacy policy of the service. Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

Vaultpress

Vaultpress is a service to save and manage backups provided by Automattic Inc. or by Aut O’Mattic A8C Ireland Ltd., depending on how the Owner manages the Data processing.

Personal Data processed: various types of Data as specified in the privacy policy of the service. Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

Building and running www.broken-luxury.com

Key components of www.broken-luxury.com are built and run directly by the Owner by making use of the software listed below.

Ghost with User subscriptions (www.broken-luxury.com)

Www.broken-luxury.com is built and run by the Owner via a CMS software (Content Management System) called Ghost.

Personal Data processed: billing address; contact info; device information; email address; first name; last name; payment info; phone number; physical address; purchase history; shipping address; Trackers; Usage Data.

Collection of privacy-related preferences

This type of service allows www.broken-luxury.com to collect and store Users’ preferences related to the collection, use, and processing of their personal information, as requested by the applicable privacy legislation.

iubenda Consent Database (iubenda srl)

The iubenda Consent Database allows to store and retrieve records of Users’ consent to the processing of Personal Data, and information and preferences expressed in relation to the provided consent.

In order to do so, it makes use of a Tracker that temporarily stores pending information on the User’s device until it is processed by the API. The Tracker (a browser feature called localStorage) is at that point deleted.

Personal Data processed: Data communicated while using the service; Trackers. Place of processing: Italy – Privacy Policy.

iubenda Privacy Controls and Cookie Solution (iubenda srl)

The iubenda Privacy Controls and Cookie Solution allows the Owner to collect and store Users’ preferences related to the processing of personal information, and in particular to the use of Cookies and other Trackers on www.broken-luxury.com.

Personal Data processed: Trackers.

Place of processing: Italy – Privacy Policy.

Commercial affiliation

This type of service allows www.broken-luxury.com to display advertisements for third-party products or services. Ads can be displayed either as advertising links or as banners using various kinds of graphics. Clicks on the icon or banner posted on the Application are tracked by the third-party services listed below,

and are shared with www.broken-luxury.com.

For details of which data are collected, please refer to the privacy policy of each service.

Amazon Affiliation

Amazon Affiliation is a commercial affiliation service provided by Amazon.com Inc. Personal Data processed: Trackers; Usage Data.

Place of processing: United States – Privacy Policy; Luxembourg – Privacy Policy.

Connecting Data

This type of service allows the Owner to connect Data with third-party services disclosed within this privacy policy.

This results in Data flowing through these services, potentially causing the retention of this Data.

Zapier (Zapier, Inc.)

Zapier is a workflow automation service provided by Zapier, Inc. that automates the movement of Data between (third-party) services.

Personal Data processed: city; company name; country; Data communicated while using the service; date of birth; device information; email address; first name; gender; geographic position; language; last name; password; phone number; picture; profession; screenshots; Usage Data; username; VAT Number; workplace; ZIP/Postal code.

Place of processing: United States – Privacy Policy. Contacting the User

Contact form (www.broken-luxury.com)

By filling in the contact form with their Data, the User authorizes www.broken-luxury.com to use these details to reply to requests for information, quotes or any other kind of request as indicated by the form’s header.

Personal Data processed: city; company name; country; county; date of birth; email address; fax number; field of activity; first name; gender; last name; number of employees; phone number; physical address; profession; state; Tax ID; Trackers; Usage Data; User ID; various types of Data; VAT Number; website; ZIP/Postal code.

Mailing list or newsletter (www.broken-luxury.com)

By registering on the mailing list or for the newsletter, the User’s email address will be added to the contact list of those who may receive email messages containing information of commercial or promotional nature concerning www.broken-luxury.com. Your email address might also be added to this list as a result of signing up to www.broken-luxury.com or after making a purchase.

Personal Data processed: city; company name; country; county; date of birth; email address; first name; gender; last name; phone number; physical address; profession; state; Trackers; Usage Data; website; ZIP/Postal code.

Data transfer outside of the UK

The Owner is allowed to transfer Personal Data collected within the UK to third countries only subject to specific legal requirements (so-called "restricted transfers"). Restricted transfers may take place according to the conditions specified below.

Users can enquire with the Owner to learn which legal basis applies to which specific service.

Data transfers according to a UK adequacy regulation (www.broken-luxury.com)

If this is the legal basis, the transfer of Personal Data from the UK to third countries may take place according to a so called “adequacy regulation” of the UK Government.

The UK Government adopts adequacy regulations for specific countries or territories whenever such countries or territories guarantee Personal Data protection standards comparable to those set forth by UK

data protection legislation. Users can find an updated list of all adequacy regulations on the website of the Information Commissioner’s Office (ICO).

Personal Data processed: various types of Data.

Data transfer abroad based on standard contractual clauses (UK) (www.broken-luxury.com)

If this is the legal basis, the transfer of Personal Data from the UK to third countries is carried out by the Owner according to “standard contractual clauses” provided by the European Commission.

This means that Data recipients have committed to process Personal Data in compliance with the data protection standards set forth by EU data protection legislation, which are recognized as valid also under UK law. For further information, Users are requested to contact the Owner through the contact details provided in the present document.

Personal Data processed: various types of Data.

Data transfer abroad based on consent (UK) (www.broken-luxury.com)

If this is the legal basis, Personal Data of Users shall be transferred from the UK to third countries only if the User has explicitly consented to such transfer, after having been informed of the possible risks due to the absence of an adequacy decision and appropriate safeguards.

In such cases, the Owner shall inform Users appropriately and collect their explicit consent via www.broken- luxury.com.

Personal Data processed: various types of Data.

Other legal basis for Data transfer abroad (UK) (www.broken-luxury.com)

If no other legal basis applies, Personal Data shall be transferred from the UK to third countries only if at least one of the following conditions is met:

the transfer is necessary for the performance of a contract between the User and the Owner or of pre- contractual measures taken at the User’s request;

the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the User between the Owner and another natural or legal person;

the transfer is necessary for important reasons of public interest;

the transfer is necessary for establishment, exercise or defence of legal claims;

the transfer is necessary in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent;

the data transferred is sourced from a public register created under UK law;

subject to further conditions, the Owner has a compelling legitimate interest to perform a one-off transfer of Personal Data.

In such cases, the Owner shall inform the User about the legal bases the transfer is based on via www.broken-luxury.com.

Personal Data processed: various types of Data.

Data transfer outside the EU

The Owner is allowed to transfer Personal Data collected within the EU to third countries (i.e. any country not part of the EU) only pursuant to a specific legal basis. Any such Data transfer is based on one of the legal bases described below.

Users can inquire with the Owner to learn which legal basis applies to which specific service.

Data transfer to countries that guarantee European standards (www.broken-luxury.com)

If this is the legal basis, the transfer of Personal Data from the EU to third countries is carried out according to an adequacy decision of the European Commission.

The European Commission adopts adequacy decisions for specific countries whenever it considers that country to possess and provide Personal Data protection standards comparable to those set forth by EU data protection legislation. Users can find an updated list of all adequacy decisions issued on the European Commission's website.

Personal Data processed: various types of Data.

Data transfer abroad based on standard contractual clauses (www.broken-luxury.com)

If this is the legal basis, the transfer of Personal Data from the EU to third countries is carried out by the Owner according to “standard contractual clauses” provided by the European Commission.

This means that Data recipients have committed to process Personal Data in compliance with the data protection standards set forth by EU data protection legislation. For further information, Users are requested to contact the Owner through the contact details provided in the present document.

Personal Data processed: various types of Data.

Data transfer abroad based on consent (www.broken-luxury.com)

If this is the legal basis, Personal Data of Users shall be transferred from the EU to third countries only if the User has explicitly consented to such transfer, after having been informed of the possible risks due to the absence of an adequacy decision and appropriate safeguards.

In such cases, the Owner shall inform Users appropriately and collect their explicit consent via www.broken- luxury.com.

Personal Data processed: various types of Data.

Other legal basis for Data transfer abroad (www.broken-luxury.com)

If no other legal basis applies, Personal Data shall be transferred from the EU to third countries only if at least one of the following conditions is met:

the transfer is necessary for the performance of a contract between the User and the Owner or of pre- contractual measures taken at the User’s request;

the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the User between the Owner and another natural or legal person;

the transfer is necessary for important reasons of public interest;

the transfer is necessary for establishment, exercise or defence of legal claims;

the transfer is necessary in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent;

the data transferred is sourced from a public register created under the law of the country that the data originates from;

subject to further conditions, the Owner has a compelling legitimate interest to perform a one-off transfer of Personal Data.

In such cases, the Owner shall inform the User about the legal bases the transfer is based on via www.broken-luxury.com.

Personal Data processed: various types of Data.

Displaying content from external platforms

This type of service allows you to view content hosted on external platforms directly from the pages of www.broken-luxury.com and interact with them.

This type of service might still collect web traffic data for the pages where the service is installed, even when Users do not use it.

Google Fonts

Google Fonts is a typeface visualization service provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Data processing, that allows www.broken-luxury.com to incorporate content of this kind on its pages.

Personal Data processed: Trackers; Usage Data.

Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

Google Maps widget

Google Maps is a maps visualization service provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Data processing, that allows www.broken-luxury.com to incorporate content of this kind on its pages.

Personal Data processed: Trackers; Usage Data.

Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

Instagram widget

Instagram is an image visualization service provided by Meta Platforms, Inc. or by Meta Platforms Ireland Limited, depending on how the Owner manages the Data processing, that allows www.broken-luxury.com to incorporate content of this kind on its pages.

Personal Data processed: Trackers; Usage Data.

Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

Bing Maps (Microsoft Corporation)

Bing Maps is a maps visualization service provided by Microsoft Corporation that allows www.broken- luxury.com to incorporate content of this kind on its pages.

Personal Data processed: Trackers; Usage Data. Place of processing: United States – Privacy Policy.

Getty Images widget (Getty Images, Inc.)

Getty Images is an image delivery service provided by Getty Images, Inc. that allows www.broken- luxury.com to incorporate content of this kind on its pages.

Personal Data processed: Trackers; Usage Data. Place of processing: United States – Privacy Policy.

Google Calendar widget

Google Calendar widget is a calendar content visualization service provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Data processing, that allows www.broken- luxury.com to incorporate content of this kind on its pages.

Personal Data processed: Trackers; Usage Data.

Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

MapKit (Apple Inc.)

MapKit is a maps visualization service provided by Apple Inc. that allows www.broken-luxury.com to incorporate content of this kind on its pages.

Personal Data processed: device information; geographic position; language; product interaction; time zone; Usage Data.

Place of processing: United States – Privacy Policy.

Handling activities related to productivity

This type of service helps the Owner to manage tasks, collaboration and, in general, activities related to productivity. In using this type of service, Data of Users will be processed and may be retained, depending on the purpose of the activity in question.

These services may be integrated with a wide range of third-party services disclosed within this privacy policy to enable the Owner to import or export Data needed for the relative activity.

Gmail

Gmail is a service that manages email communication provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Data processing. Such email communication is not scanned by Google for advertising purposes. In addition, Google does not collect or use data inside this service for advertising purposes in any other way.

Personal Data processed: city; company name; country; Data communicated while using the service; date of birth; email address; first name; gender; geographic position; last name; password; phone number; physical address; profession; profile picture; screenshots; Trackers; Usage Data; username; VAT Number; workplace.

Place of processing: United States – Privacy Policy; Ireland – Privacy Policy. Handling payments

Unless otherwise specified, www.broken-luxury.com processes any payments by credit card, bank transfer or other means via external payment service providers. In general and unless where otherwise stated, Users are requested to provide their payment details and personal information directly to such payment service providers. Www.broken-luxury.com isn't involved in the collection and processing of such information: instead, it will only receive a notification by the relevant payment service provider as to whether payment has been successfully completed.

PayPal (PayPal Inc.)

PayPal is a payment service provided by PayPal Inc., which allows Users to make online payments.

Personal Data processed: billing address; device information; email address; first name; last name; password; payment info; phone number; purchase history; Trackers; Usage Data; username; various types of Data as specified in the privacy policy of the service.

Place of processing: See the PayPal privacy policy – Privacy Policy.

PayPal Carrier Payments (PayPal Inc.)

PayPal Carrier Payments is a payment service provided by PayPal, Inc., which allows Users to make online payments using their mobile phone operator.

Personal Data processed: billing address; device information; email address; first name; last name; payment info; phone number; purchase history; Trackers; Usage Data; various types of Data as specified in the privacy policy of the service.

Place of processing: See the PayPal privacy policy – Privacy Policy.

PayPal Payments Hub (PayPal Inc.)

PayPal Payments Hub is a payment service provided by PayPal Inc.

Place of processing: See the PayPal privacy policy – Privacy Policy.

Klarna (Klarna AB)

Klarna is a payment service provided by Klarna AB.

Personal Data processed: billing address; email address; first name; last name; payment info; phone number; shipping address; Trackers; Usage Data; various types of Data as specified in the privacy policy of the service.

Place of processing: Sweden – Privacy Policy.

Amazon Payments (Amazon)

Amazon Payments is a payment service provided by Amazon.com, Inc., which allows Users to make online payments using their Amazon credentials.

Personal Data processed: billing address; email address; first name; last name; password; payment info; phone number; purchase history; shipping address; Trackers; Usage Data; username; various types of Data as specified in the privacy policy of the service.

Place of processing: See the Amazon privacy policy – Privacy Policy.

Stripe

Stripe is a payment service provided by Stripe, Inc., Stripe Payments Europe, Limited, Stripe Payments UK, Ltd, Stripe Brasil Soluções de Pagamento - Instituição de Pagamento Ltda., Stripe Payments Canada, Ltd., Stripe India Private Ltd., Stripe Japan KK, Stripe Payments Malaysia Sdn. Bhd., Stripe Payments Mexico, S. de R.L. de C.V., Stripe New Zealand Limited, Stripe Payments Singapore Pte. Ltd. or by Stripe Payments (Thailand) Ltd., depending on how the Owner manages the Data processing.

Personal Data processed: billing address; email address; first name; last name; payment info; purchase history; Trackers; Usage Data; various types of Data as specified in the privacy policy of the service.

Place of processing: United States – Privacy Policy; European Union – Privacy Policy; United Kingdom – Privacy Policy; Gibraltar – Privacy Policy; Hong Kong – Privacy Policy; Liechtenstein – Privacy Policy; Norway – Privacy Policy; Switzerland – Privacy Policy; United Arab Emirates – Privacy Policy; United Kingdom – Privacy Policy; Brazil – Privacy Policy; Canada – Privacy Policy; India – Privacy Policy; Japan – Privacy Policy; Malaysia – Privacy Policy; Mexico – Privacy Policy; New Zealand – Privacy Policy; Singapore – Privacy Policy; Thailand – Privacy Policy.

Adyen (Adyen B.V.)

Adyen is a payment service provided by Adyen B.V.

Personal Data processed: billing address; email address; first name; last name; payment info; purchase history; shipping address; Trackers; Usage Data; various types of Data as specified in the privacy policy of the service.

Place of processing: Netherlands – Privacy Policy.

Android Pay

Android Pay is a payment service provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Data processing, which allows Users to make payments using their mobile phones.

Personal Data processed: billing address; email address; first name; last name; payment info; phone number; purchase history; shipping address; Trackers; Usage Data; various types of Data as specified in the privacy policy of the service.

Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

Apple Pay (Apple Inc.)

Apple Pay is a payment service provided by Apple Inc., which allows Users to make payments using their mobile phones.

Place of processing: United States – Privacy Policy.

Coinbase (Coinbase Inc.)

Coinbase is a payment service provided by Coinbase, Inc.

Place of processing: United States – Privacy Policy.

Google Pay

Google Pay is a payment service provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Data processing, which allows users to make online payments using their Google credentials.

Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

Payment by bank transfer (www.broken-luxury.com)

In the event that the chosen payment method is a direct bank transfer to the current account indicated by www.broken-luxury.com, the Owner will collect the payment details of the User, i. e. the current account number of the sender, the SWIFT code, the bank and the name of the sender. Such data will be collected and processed exclusively within the transaction and for billing purposes only.

Personal Data processed: company name; first name; last name; payment info; physical address.

Hosting and backend infrastructure

This type of service has the purpose of hosting Data and files that enable www.broken-luxury.com to run and be distributed as well as to provide a ready-made infrastructure to run specific features or parts of www.broken-luxury.com.

Some services among those listed below, if any, may work through geographically distributed servers, making it difficult to determine the actual location where the Personal Data are stored.

Amazon Web Services (AWS) (Amazon Web Services, Inc.)

Amazon Web Services (AWS) is a hosting and backend service provided by Amazon Web Services, Inc. Personal Data processed: various types of Data as specified in the privacy policy of the service.

Place of processing: United States – Privacy Policy; Canada – Privacy Policy; Brazil – Privacy Policy; Ireland – Privacy Policy; United Kingdom – Privacy Policy; France – Privacy Policy; Germany – Privacy Policy; India – Privacy Policy; Australia – Privacy Policy; China – Privacy Policy; Korea, Republic of – Privacy Policy; Japan – Privacy Policy; Singapore – Privacy Policy; Italy – Privacy Policy; Sweden – Privacy Policy; Bahrain – Privacy Policy; South Africa – Privacy Policy.

Infrastructure monitoring

This type of service allows www.broken-luxury.com to monitor the use and behavior of its components so its performance, operation, maintenance and troubleshooting can be improved.

Which Personal Data are processed depends on the characteristics and mode of implementation of these services, whose function is to filter the activities of www.broken-luxury.com.

Sentry (Functional Software, Inc. )

Sentry is a monitoring service provided by Functional Software, Inc. .

Personal Data processed: various types of Data as specified in the privacy policy of the service. Place of processing: United States – Privacy Policy.

Bugsnag (Bugsnag Inc.)

Bugsnag is a monitoring service provided by Bugsnag Inc.

Personal Data processed: app information; country; date of birth; device information; device logs; email address; first name; gender; geographic position; last name; phone number; physical address; screenshots; Trackers; Usage Data; username; various types of Data as specified in the privacy policy of the service.

Place of processing: United States – Privacy Policy.

Interaction with data collection platforms and other third parties

This type of service allows Users to interact with data collection platforms or other services directly from the pages of www.broken-luxury.com for the purpose of saving and reusing data.

If one of these services is installed, it may collect browsing and Usage Data in the pages where it is installed, even if the Users do not actively use the service.

Google Forms (embedded)

Google Forms (embedded) is a service for interacting with the Google data collection platform provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Data processing.

Personal Data processed: answers to questions; company name; country; Data communicated while using the service; date of birth; email address; first name; gender; language; last name; password; phone number; physical address; picture; profession; profile picture; state; Trackers; Usage Data; username; VAT Number; ZIP/Postal code.

Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

Mailchimp widget (Intuit Inc.)

The Mailchimp widget is a service for interacting with the Mailchimp email address management and

message sending service provided by Intuit Inc.

Personal Data processed: email address; first name; last name; phone number; Trackers; Usage Data. Place of processing: United States – Privacy Policy.

Typeform widget (TYPEFORM S.L)

The Typeform widget is a service for interacting with the Typeform data collection platform provided by TYPEFORM S.L.

Personal Data processed: billing address; city; company name; country; county; Data communicated while using the service; date of birth; email address; fax number; field of activity; first name; gender; geographic position; language; last name; marital status; number of employees; phone number; physical address; picture; profession; profile picture; shipping address; state; Tax ID; Trackers; Usage Data; User ID; username; various types of Data as specified in the privacy policy of the service; VAT Number; website; workplace.

Place of processing: Spain – Privacy Policy.

Interaction with external social networks and platforms

This type of service allows interaction with social networks or other external platforms directly from the pages of www.broken-luxury.com.

The interaction and information obtained through www.broken-luxury.com are always subject to the User’s privacy settings for each social network.

This type of service might still collect traffic data for the pages where the service is installed, even when Users do not use it.

It is recommended to log out from the respective services in order to make sure that the processed data on www.broken-luxury.com isn’t being connected back to the User’s profile.

Twitter Tweet button and social widgets (Twitter, Inc.)

The Twitter Tweet button and social widgets are services allowing interaction with the Twitter social network provided by Twitter, Inc.

Personal Data processed: Trackers; Usage Data. Place of processing: United States – Privacy Policy.

Facebook Like button and social widgets

The Facebook Like button and social widgets are services allowing interaction with the Facebook social network provided by Meta Platforms, Inc. or by Meta Platforms Ireland Limited, depending on how the Owner manages the Data processing,

Personal Data processed: Trackers; Usage Data.

Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

PayPal button and widgets (PayPal Inc.)

The PayPal button and widgets are services allowing interaction with the PayPal platform provided by PayPal Inc.

Personal Data processed: Trackers; Usage Data.

Place of processing: See the PayPal privacy policy – Privacy Policy.

Pinterest “Pin it” button and social widgets (Pinterest, Inc.)

The Pinterest “Pin it” button and social widgets are services allowing interaction with the Pinterest platform provided by Pinterest Inc.

Personal Data processed: Trackers; Usage Data. Place of processing: United States – Privacy Policy.

VK Like button and social widgets (VKontakte Ltd)

The VK Like button and social widgets are services allowing interaction with the VK social network provided by VKontakte Ltd.

Personal Data processed: Trackers; Usage Data.

Place of processing: Russian Federation – Privacy Policy.

AngelList follow button and social widgets ( Venture Hacks, Inc.)

The AngelList follow button and social widgets are services allowing interaction with the AngelList network provided by Venture Hacks, Inc.

Personal Data processed: Trackers; Usage Data. Place of processing: United States – Privacy Policy.

Coinbase button and widgets (Coinbase Inc.)

The Coinbase button and widgets are services allowing interaction with the Coinbase platform provided by Coinbase Inc.

Personal Data processed: Trackers; Usage Data. Place of processing: United States – Privacy Policy.

Reddit button and widgets (reddit inc.)

The reddit button and widgets are services allowing interaction with the reddit platform provided by reddit inc.

Personal Data processed: Trackers; Usage Data. Place of processing: United States – Privacy Policy.

Buffer button and social widgets (Buffer)

The Buffer button and social widgets are services allowing interaction with the Buffer service provided by Buffer, Inc.

Personal Data processed: Usage Data.

Place of processing: United States – Privacy Policy.

AddToAny (AddToAny LLC)

AddToAny is a service provided by AddToAny LLC, which displays a widget that allows interaction with social networks and external platforms as well as sharing the contents of www.broken-luxury.com.

Data collected through the service may be used to help deliver interest-based advertising. Users can opt out of third-party interest-based advertising by visiting the Network Advertising Initiative opt-out page.

Personal Data processed: Trackers; Usage Data. Place of processing: United States – Privacy Policy.

GetSiteControl social widget (GetWebCraft Limited)

GetSiteControl social widget is a service provided by GetWebCraft Limited, which displays a widget that allows interaction with social networks and external platforms as well as sharing the contents of www.broken-luxury.com.

Personal Data processed: Trackers; Usage Data. Place of processing: Cyprus – Privacy Policy.

Google Friend Connect

Google Friend Connect is a social interaction service provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Data processing.

Personal Data processed: Trackers; Usage Data.

Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

Po.st (RhythmOne, LLC)

Po.st is a service provided by RhythmOne, LLC, which displays a widget that allows interaction with social networks and external platforms as well as sharing the contents of www.broken-luxury.com.

Depending on the configuration, this service can display widgets belonging to third parties such as the managers of social networks where interactions are shared. In this case, also the third parties that provide the widget will be informed of interactions and Usage Data on the pages where this service is installed. This service not only allows interaction with social networks and external platforms, but it also shows ads provided directly by Po.st or by third-party advertising networks.

Personal Data processed: Trackers; Usage Data. Place of processing: United States – Privacy Policy.

LinkedIn button and social widgets (LinkedIn Corporation)

The LinkedIn button and social widgets are services allowing interaction with the LinkedIn social network provided by LinkedIn Corporation.

Personal Data processed: Trackers; Usage Data. Place of processing: United States – Privacy Policy.

Myspace button and social widgets (Myspace LLC)

The Myspace button and social widgets are services allowing interaction with the Myspace social network provided by Myspace LLC.

Personal Data processed: Usage Data.

Place of processing: United States – Privacy Policy.

Tumblr sharing button and social widgets (Tumblr Inc.)

The Tumblr sharing button and social widgets are services allowing interaction with the Tumblr social network provided by Tumblr Inc.

Personal Data processed: Trackers; Usage Data. Place of processing: United States – Privacy Policy.

Weibo button and social widgets (Sina Corp)

The Weibo button and social widgets are services allowing interaction with the Weibo social network provided by Sina Corp.

Personal Data processed: Trackers; Usage Data. Place of processing: China – Privacy Policy.

YouTube button and social widgets

The YouTube button and social widgets are services allowing interaction with the YouTube social network provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Data processing.

Personal Data processed: Usage Data.

Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

Mix button and social widgets (Mix Tech, Inc.)

The Mix button and social widgets are services allowing interaction with the Mix social network provided by Mix Tech, Inc.

Personal Data processed: Trackers; Usage Data. Place of processing: United States – Privacy Policy.

Interaction with support and feedback platforms

This type of service allows Users to interact with third-party support and feedback platforms directly from the pages of www.broken-luxury.com.

If one of these services is installed, it may collect browsing and Usage Data in the pages where it is installed, even if the Users do not actively use the service.

Zendesk Widget (Zendesk, Inc.)

The Zendesk Widget is a service for interacting with the Zendesk support and feedback platform provided by Zendesk Inc.

Personal Data processed: company name; country; date of birth; email address; first name; gender; last name; phone number; physical address; Trackers; Usage Data; username.

Place of processing: United States – Privacy Policy.

Managing contacts and sending messages

This type of service makes it possible to manage a database of email contacts, phone contacts or any other contact information to communicate with the User.

These services may also collect data concerning the date and time when the message was viewed by the User, as well as when the User interacted with it, such as by clicking on links included in the message.

Klaviyo (Klaviyo Inc.)

Klaviyo is an email address management and message sending service provided by Klaviyo Inc.

To take advantage of the service provided by Klaviyo, the Owner typically shares information about (purchasing) Users, such as for example contact details and shopping histories. Check the indication at “Personal Data processed“ below for an explanation of the extent of the sharing.

Personal Data processed: company name; country; date of birth; email address; first name; gender; last name; phone number; physical address; profession; purchase history; state; Trackers; Usage Data; username; various types of Data.

Place of processing: United States – Privacy Policy – Opt out.

HubSpot Email (HubSpot, Inc.)

HubSpot Email is an email address management and message sending service provided by HubSpot, Inc. Personal Data processed: email address; Usage Data.

Place of processing: United States – Privacy Policy.

Mailchimp (Intuit Inc.)

Mailchimp is an email address management and message sending service provided by Intuit Inc.

Personal Data processed: company name; country; Data communicated while using the service; date of birth; email address; first name; gender; last name; phone number; physical address; Trackers; Usage Data; username; various types of Data.

Place of processing: United States – Privacy Policy.

Managing data collection and online surveys

This type of service allows www.broken-luxury.com to manage the creation, deployment, administration, distribution and analysis of online forms and surveys in order to collect, save and reuse Data from any

responding Users.

The Personal Data collected depend on the information asked and provided by the Users in the corresponding online form.

These services may be integrated with a wide range of third-party services to enable the Owner to take subsequent steps with the Data processed - e.g. managing contacts, sending messages, analytics, advertising and payment processing.

Klaviyo Forms (Klaviyo Inc.)

Klaviyo Forms is a form builder and data collection platform provided by Klaviyo Inc.

Personal Data processed: city; company name; country; Data communicated while using the service; date of birth; email address; first name; gender; last name; phone number; physical address; profession; purchase history; state; Trackers; Usage Data; username.

Place of processing: United States – Privacy Policy.

Platform services and hosting

These services have the purpose of hosting and running key components of www.broken-luxury.com, therefore allowing the provision of www.broken-luxury.com from within a unified platform. Such platforms provide a wide range of tools to the Owner – e.g. analytics, user registration, commenting, database management, e-commerce, payment processing – that imply the collection and handling of Personal Data. Some of these services work through geographically distributed servers, making it difficult to determine the actual location where the Personal Data are stored.

Shopify

Shopify is a platform provided by Shopify Inc. that allows the Owner to build, run and host an e-commerce website.

Personal Data processed: billing address; device information; email address; first name; last name; payment info; phone number; shipping address; Trackers; Usage Data.

Place of processing: Canada – Privacy Policy; Singapore – Privacy Policy; Ireland – Privacy Policy.

Registration and authentication

By registering or authenticating, Users allow www.broken-luxury.com to identify them and give them access to dedicated services.

Depending on what is described below, third parties may provide registration and authentication services. In this case, www.broken-luxury.com will be able to access some Data, stored by these third-party services, for registration or identification purposes.

Some of the services listed below may also collect Personal Data for targeting and profiling purposes; to find out more, please refer to the description of each service.

Log In with PayPal is a registration and authentication service provided by PayPal Inc. and is connected to the PayPal network.

Personal Data processed: various types of Data as specified in the privacy policy of the service. Place of processing: See the PayPal privacy policy – Privacy Policy.

Instagram Authentication

Instagram Authentication is a registration and authentication service provided by Meta Platforms, Inc. or by Meta Platforms Ireland Limited, depending on how the Owner manages the Data processing, and is connected to the Instagram social network.

Personal Data processed: various types of Data as specified in the privacy policy of the service. Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

Pinterest OAuth (Pinterest, Inc.)

Pinterest OAuth is a registration and authentication service provided by Pinterest, Inc. and is connected to the Pinterest social network.

Personal Data processed: various types of Data as specified in the privacy policy of the service. Place of processing: United States – Privacy Policy.

VK Client Authorization (VKontakte Ltd)

VK Client Authorization is a registration and authentication service provided by VKontakte Ltd and is connected to the VK social network.

Personal Data processed: various types of Data as specified in the privacy policy of the service. Place of processing: Russian Federation – Privacy Policy.

Login with Amazon is a registration and authentication service provided by Amazon.com, Inc. Personal Data processed: various types of Data as specified in the privacy policy of the service. Place of processing: United States – Privacy Policy.

Google OAuth

Google OAuth is a registration and authentication service provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Data processing, and is connected to the Google network.

Personal Data processed: various types of Data as specified in the privacy policy of the service. Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

Auth0 (Auth0, Inc)

Auth0 is a registration and authentication service provided by Auth0, Inc. To simplify the registration and authentication process, Auth0 can make use of third-party identity providers and save the information on its platform.

Personal Data processed: email address; first name; last name; password; picture; Trackers; various types of Data as specified in the privacy policy of the service.

Place of processing: United States – Privacy Policy; European Union – Privacy Policy; Australia – Privacy Policy.

Direct registration and profiling (www.broken-luxury.com)

By registering or authenticating directly through www.broken-luxury.com, Users allow www.broken- luxury.com to identify them and give them access to dedicated services. The Owner may process Data collected when Users register or authenticate also for targeting and profiling purposes; to find out more, Users can contact the Owner using the contact details provided in this document.

Personal Data processed: billing address; budget; company name; country; county; data relating to the point of sale; date of birth; email address; fax number; field of activity; first name; gender; geographic position; house number; language; last name; marital status; number of employees; password; phone number; physical address; picture; prefix ; profession; profile picture; shipping address; Social Security number (SSN); state; Tax ID; Trackers; Twitter handle; Usage Data; User ID; username; various types of Data; VAT Number; website; workplace; ZIP/Postal code.

Facebook Oauth

Facebook Oauth is a registration and authentication service provided by Meta Platforms, Inc. or by Meta Platforms Ireland Limited, depending on how the Owner manages the Data processing, and is connected to the Facebook social network.

Personal Data processed: Trackers; various types of Data.

Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

Linkedin OAuth (LinkedIn Corporation)

Linkedin Oauth is a registration and authentication service provided by Linkedin Corporation and is connected to the Linkedin social network.

Personal Data processed: Trackers; Usage Data; various types of Data as specified in the privacy policy of the service.

Place of processing: United States – Privacy Policy.

Sign in with Apple is a registration and authentication service provided by Apple Inc. In cases where Users are required to provide their email address, Sign in with Apple may generate a private relay address on behalf of Users that automatically forwards messages to their verified personal email account - therefore shielding their actual email address from the Owner.

Personal Data processed: city; country; date of birth; email address; first name; geography/region; last name; password; phone number; profile picture; User ID.

Place of processing: United States – Privacy Policy.

Stripe OAuth

Stripe OAuth is a registration and authentication service provided by Stripe, Inc. and is connected to the Stripe network.

Personal Data processed: Trackers; various types of Data as specified in the privacy policy of the service.

Place of processing: European Union – Privacy Policy; Gibraltar – Privacy Policy; Hong Kong – Privacy Policy; Liechtenstein – Privacy Policy; Brazil – Privacy Policy; Canada – Privacy Policy; India – Privacy Policy; Japan – Privacy Policy; Malaysia – Privacy Policy; Mexico – Privacy Policy; New Zealand – Privacy Policy.

Registration and authentication provided directly by www.broken-luxury.com

By registering or authenticating, Users allow www.broken-luxury.com to identify them and give them access to dedicated services. The Personal Data is collected and stored for registration or identification purposes only. The Data collected are only those necessary for the provision of the service requested by the Users.

Direct registration (www.broken-luxury.com)

The User registers by filling out the registration form and providing the Personal Data directly to www.broken-luxury.com.

Personal Data processed: academic background; billing address; budget; city; company name; country; county; date of birth; email address; fax number; field of activity; first name; gender; house number; language; last name; number of employees; password; phone number; physical address; picture; prefix ; profession; profile picture; Social Security number (SSN); state; Tax ID; Trackers; Twitter handle; Usage Data; User ID; username; various types of Data; VAT Number; website; workplace; ZIP/Postal code.

Remarketing and behavioral targeting

This type of service allows www.broken-luxury.com and its partners to inform, optimize and serve advertising based on past use of www.broken-luxury.com by the User.

This activity is facilitated by tracking Usage Data and by using Trackers to collect information which is then transferred to the partners that manage the remarketing and behavioral targeting activity.

Some services offer a remarketing option based on email address lists.

Klaviyo segmentation and social advertising (Klaviyo Inc.)

Klaviyo segmentation and social advertising is a remarketing and behavioral targeting service provided by Klaviyo Inc.

Klaviyo segmentation and social advertising makes use of tracking technologies to monitor User behavior. This Data is then used to personalize the User's experience and to provide targeted advertising. Klaviyo segmentation and social advertising may also connect the collected Data with other networks, including advertising networks, and enable these parties to track and target the User. The Owner, unless otherwise specified in this document, has no direct relationship with the third parties that Klaviyo segmentation and social advertising may be including.

Personal Data processed: device information; email address; purchase history; Trackers; Usage Data. Place of processing: United States – Privacy Policy – Opt out.

Selling goods and services online

This type of service helps the Owner to sell goods, provide services or monetize online content. To this end, the services listed below may for instance allow the Owner to process payments, set up subscription models, track orders, and manage deliveries.

Chargebee (Chargebee Inc.)

Chargebee is a subscription management tool provided by Chargebee Inc, which allows the Owner to manage subscriptions, invoicing, pricing models, and subscription and revenue analytics.

Personal Data processed: billing address; company name; Data communicated while using the service; email address; financial information; first name; in-app purchases; invoicing information; last name; payment info; phone number; purchase history; shipping address; Trackers; Usage Data; User ID; user subscriptions.

Place of processing: United States – Privacy Policy.

SPAM protection

This type of service analyzes the traffic of www.broken-luxury.com, potentially containing Users' Personal Data, with the purpose of filtering it from parts of traffic, messages and content that are recognized as SPAM.

hCaptcha (Intuition Machines, Inc)

hCaptcha is a SPAM protection service provided by Intuition Machines, Inc.

Personal Data processed: answers to questions; Data communicated in order to use the Service; keypress events; motion sensor events; mouse movements; scroll position; touch events; Trackers; Usage Data.

Place of processing: United States – Privacy Policy.

Google reCAPTCHA

Google reCAPTCHA is a SPAM protection service provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Data processing.

The use of reCAPTCHA is subject to the Google privacy policy and terms of use.

Personal Data processed: answers to questions; clicks; keypress events; motion sensor events; mouse movements; scroll position; touch events; Trackers; Usage Data.

Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

Tag Management

This type of service helps the Owner to manage the tags or scripts needed on www.broken-luxury.com in a centralized fashion.

This results in the Users' Data flowing through these services, potentially resulting in the retention of this Data.

Google Tag Manager

Google Tag Manager is a tag management service provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Data processing.

Personal Data processed: Trackers; Usage Data.

Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

User database management

This type of service allows the Owner to build user profiles by starting from an email address, a personal name, or other information that the User provides to www.broken-luxury.com, as well as to track User activities through analytics features. This Personal Data may also be matched with publicly available information about the User (such as social networks' profiles) and used to build private profiles that the Owner can display and use for improving www.broken-luxury.com.

Some of these services may also enable the sending of timed messages to the User, such as emails based on specific actions performed on www.broken-luxury.com.

Klaviyo CRM (Klaviyo Inc.)

Klaviyo CRM is a User database management service provided by Klaviyo Inc.

Klaviyo CRM can also be used as a medium for communications, either through email, or through messages within www.broken-luxury.com.

Personal Data processed: city; company name; country; date of birth; email address; first name; gender; last name; phone number; physical address; profession; purchase history; state; Trackers; Usage Data; username; various types of Data.

Place of processing: United States – Privacy Policy.

Information on opting out of interest-based advertising

In addition to any opt-out feature provided by any of the services listed in this document, Users may learn more on how to generally opt out of interest-based advertising within the dedicated section of the Cookie Policy.

Further information about the processing of Personal Data Selling goods and services online

The Personal Data collected are used to provide the User with services or to sell goods, including payment and possible delivery.

The Personal Data collected to complete the payment may include the credit card, the bank account used for the transfer, or any other means of payment envisaged. The kind of Data collected by www.broken- luxury.com depends on the payment system used.

The rights of Users

Users may exercise certain rights regarding their Data processed by the Owner. In particular, Users have the right to do the following:

Withdraw their consent at any time. Users have the right to withdraw consent where they have previously given their consent to the processing of their Personal Data.

Object to processing of their Data. Users have the right to object to the processing of their Data if the processing is carried out on a legal basis other than consent. Further details are provided in the dedicated section below.

Access their Data. Users have the right to learn if Data is being processed by the Owner, obtain disclosure regarding certain aspects of the processing and obtain a copy of the Data undergoing processing.

Verify and seek rectification. Users have the right to verify the accuracy of their Data and ask for it to be updated or corrected.

Restrict the processing of their Data. Users have the right, under certain circumstances, to restrict the processing of their Data. In this case, the Owner will not process their Data for any purpose other than storing it.

Have their Personal Data deleted or otherwise removed. Users have the right, under certain

circumstances, to obtain the erasure of their Data from the Owner.

Receive their Data and have it transferred to another controller. Users have the right to receive their Data in a structured, commonly used and machine readable format and, if technically feasible, to have it transmitted to another controller without any hindrance. This provision is applicable provided that the Data is processed by automated means and that the processing is based on the User's consent, on a contract which the User is part of or on pre-contractual obligations thereof.

Lodge a complaint. Users have the right to bring a claim before their competent data protection authority.

Details about the right to object to processing

Where Personal Data is processed for a public interest, in the exercise of an official authority vested in the Owner or for the purposes of the legitimate interests pursued by the Owner, Users may object to such processing by providing a ground related to their particular situation to justify the objection.

Users must know that, however, should their Personal Data be processed for direct marketing purposes, they can object to that processing at any time without providing any justification. To learn, whether the Owner is processing Personal Data for direct marketing purposes, Users may refer to the relevant sections of this document.

How to exercise these rights

Any requests to exercise User rights can be directed to the Owner through the contact details provided in this document. These requests can be exercised free of charge and will be addressed by the Owner as early as possible and always within one month.

Cookie Policy

Www.broken-luxury.com uses Trackers. To learn more, the User may consult the Cookie Policy.

Additional information about Data collection and processing

Legal action

The User's Personal Data may be used for legal purposes by the Owner in Court or in the stages leading to possible legal action arising from improper use of www.broken-luxury.com or the related Services.

The User declares to be aware that the Owner may be required to reveal personal data upon request of public authorities.

Additional information about User's Personal Data

In addition to the information contained in this privacy policy, www.broken-luxury.com may provide the User with additional and contextual information concerning particular Services or the collection and processing of Personal Data upon request.

System logs and maintenance

For operation and maintenance purposes, www.broken-luxury.com and any third-party services may collect files that record interaction with www.broken-luxury.com (System logs) or use other Personal Data (such as the IP Address) for this purpose.

Information not contained in this policy

More details concerning the collection or processing of Personal Data may be requested from the Owner at any time. Please see the contact information at the beginning of this document.

How “Do Not Track” requests are handled

Www.broken-luxury.com does not support “Do Not Track” requests.

To determine whether any of the third-party services it uses honor the “Do Not Track” requests, please read their privacy policies.

Changes to this privacy policy

The Owner reserves the right to make changes to this privacy policy at any time by notifying its Users on this page and possibly within www.broken-luxury.com and/or - as far as technically and legally feasible - sending a notice to Users via any contact information available to the Owner. It is strongly recommended to check

this page often, referring to the date of the last modification listed at the bottom.

Should the changes affect processing activities performed on the basis of the User’s consent, the Owner shall collect new consent from the User, where required.

Definitions and legal references

Personal Data (or Data)

Any information that directly, indirectly, or in connection with other information — including a personal identification number — allows for the identification or identifiability of a natural person.

Usage Data

Information collected automatically through www.broken-luxury.com (or third-party services employed in www.broken-luxury.com), which can include: the IP addresses or domain names of the computers utilized by the Users who use www.broken-luxury.com, the URI addresses (Uniform Resource Identifier), the time of the request, the method utilized to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server's answer (successful outcome, error, etc.), the country of origin, the features of the browser and the operating system utilized by the User, the various time details per visit (e.g., the time spent on each page within the Application) and the details about the path followed within the Application with special reference to the sequence of pages visited, and other parameters about the device operating system and/or the User's IT environment.

User

The individual using www.broken-luxury.com who, unless otherwise specified, coincides with the Data Subject.

Data Subject

The natural person to whom the Personal Data refers.

Data Processor (or Data Supervisor)

The natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller, as described in this privacy policy.

Data Controller (or Owner)

The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data, including the security measures concerning the operation and use of www.broken-luxury.com. The Data Controller, unless otherwise specified, is the Owner of www.broken-luxury.com.

www.broken-luxury.com (or this Application)

The means by which the Personal Data of the User is collected and processed.

Service

The service provided by www.broken-luxury.com as described in the relative terms (if available) and on this site/application.

European Union (or EU)

Unless otherwise specified, all references made within this document to the European Union include all current member states to the European Union and the European Economic Area.

Cookies are Trackers consisting of small sets of data stored in the User's browser.

Tracker

Tracker indicates any technology - e.g Cookies, unique identifiers, web beacons, embedded scripts, e-tags

and fingerprinting - that enables the tracking of Users, for example by accessing or storing information on the User’s device.

Provides access to the User's primary email address.

Legal information

This privacy statement has been prepared based on provisions of multiple legislations, including Art. 13/14 of Regulation (EU) 2016/679 (General Data Protection Regulation).

This privacy policy relates solely to www.broken-luxury.com, if not stated otherwise within this document. Latest update: March 09, 2023

Privacy policy

Privacy Policy of www.broken-luxury.com

Fast Shipping

Secure Payments

Customer Support